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As required by law, we have identified the Department of Transportation's (DOT) top 
management challenges for fiscal year 2013. A safe and well-managed transportation 
system is key for the U.S. economy and the quality of life for the traveling public. To 
maintain and modernize all modes of transportation, the Department spends over 
$70 billion annually on a wide range of programs. Consequently, it is critical for the 
Department to carry out its mission within a framework of rigorous stewardship of 
taxpayer funds, and we continue to support the Department's efforts through our 
audits and investigations. 

Global and domestic travel are projected to significantly increase the demand on our 
transportation system, and the Department faces considerable challenges in improving 
the Nation's surface infrastructure and airspace. A key issue is the Next Generation 
Air Transportation System — a multibillion-dollar effort to modernize the U.S. air 
traffic control system. The Department is working diligently to address numerous 
challenges we have identified over the years with this highly complex undertaking. 
However, much work remains to move from planning to implementation, tighten cost 
and schedule controls, and better define benefits and an end state for users. 

It is also critical that the Department take every opportunity to make efficient use of 
funds through improved acquisition and grant management — an ongoing challenge 
with multi-modal impact. This past year, our work also highlighted the need for the 
Department to better safeguard its investments in key assets to support or expand 
transportation. These challenges include enforcing reforms to business practices, 
closely overseeing financing plans, and protecting critical information systems. 
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Improving air and surface safety continues to be the Department's overarching 
priority. This past year, the Department has made important progress toward meeting 
new airline safety regulations to advance voluntary safety programs at air carriers and 
improve pilot rest requirements. To maintain the Nation's excellent aviation safety 
record, the Department must address a number of challenges. These include 
maximizing existing data to identify trends and root causes of safety issues, enhancing 
risk-based oversight at carriers and repair stations, and mitigating air traffic controller 
fatigue. 

In terms of surface safety, fatalities on the Nation's highways have generally declined 
over the last several years; however, the safety of the Nation's highways, railroads, 
and pipelines remains an ongoing concern. The Department must implement a number 
of safety requirements enacted in 2012 to identify defective vehicles, better protect 
motor coach passengers, enhance mass transit safety, and develop a national tunnel 
inspection program. 

We continue to build a body of work to assist the Department with its critical mission; 
improve the management and execution of programs; and protect the Department's 
resources from fraud, waste, abuse, and violations of law. We considered several 
criteria in identifying the following nine challenges, including their impact on safety, 
documented vulnerabilities, large dollar implications, and the ability of the 
Department to effect change in these areas: 

• Ensuring the Next Generation Air Transportation System Advances Safety and Air 
Travel 

• Enhancing FAA's Oversight and Use of Data To Identify and Mitigate Safety 
Risks 

• Overseeing Administration of Key Transportation Assets To Ensure Their Success 
and Sustainability 

• Strengthening Existing Surface Safety Programs and Effectively Implementing 
New Safety Requirements 

• Maximizing Surface Infrastructure Investments With Effective Program Oversight 
and Execution of New Legislative Requirements 

• Adequately Overseeing Administration of High Speed Intercity Passenger Rail 
Grant Funds 

• Strengthening Financial Management Over Grants To Better Use Funds, Create 
Jobs, and Improve Infrastructure 
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• Ensuring Effective Management of DOT's Acquisitions To Maximize Value and 
Program Performance 



• Managing and Securing Information Systems To Efficiently Modernize 
Technology Infrastructure and Protect Sensitive Data From Compromise 

We are committed to keeping decision makers informed of issues identified through 
our audits and investigations. We appreciate the Department's commitment to taking 
prompt corrective action in response to our findings and recommendations. This 
report and the Department's response will be included in the Department's Annual 
Financial Report, as required by law. The Department's response is included in its 
entirety in the appendix to this report. If you have any questions regarding this report, 
please contact me at (202) 366-1959. You may also contact Lou E. Dixon, Principal 
Assistant Inspector General for Audits and Evaluation, at (202) 366-1427. 

# 

cc: DOT Audit Liaison, M-l 
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Ensuring the Next Generation Air 
Transportation System Advances Safety 
and Air Travel 




Source: Federal Aviation Administration 



The National Airspace System (NAS) handles almost 50,000 flights per day and more than 
700 million passengers per year. Air travel is expected to nearly double over the next 
2 decades, and the Federal Aviation Administration (FAA) has been working for 8 years to 
develop the Next Generation Air Transportation System (NextGen). NextGen is intended to 
modernize aging equipment, systems, and facilities and improve airspace efficiency. While 
FAA has made some progress toward improved air traffic management, our work continues 
to find longstanding problems with cost increases, schedule slips, and performance 
shortfalls with key FAA modernization projects— challenges that have been exacerbated by 
the fiscally constrained Federal environment. 

Key Challenges 

• Realizing benefits from NextGen capabilities at congested airports in the near term 

• Mitigating risks that delays with the En Route Automation Modernization program pose 
to critical NextGen initiatives 

• Making decisions on facility consolidation and modernization 

• Completing an integrated master schedule for NextGen transformational programs 

• Achieving expected outcomes from reorganization to improve NextGen management 

• Integrating Unmanned Aircraft Systems in the National Airspace System 
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Realizing Benefits From NextGen Capabilities at Congested Airports in the 
Near Term In response to recommendations by a Government-industry task force in 
2009, FAA launched its "metroplex" initiative— a 7-year effort to improve the flow of traffic 
and efficiency at congested airports in 13 major metropolitan areas. FAA completed initial 
studies to identify and recommend airspace and procedure improvements at 7 of the 
13 metroplex locations and is performing design work at 6. However, FAA continues to face 
challenges with shifting from planning to implementation. The expected completion date 
for all metroplex sites is now 15 months later than FAA planned. Further, industry 
representatives are concerned that the effort may not deliver all desired benefits since FAA 
has focused on limited airspace and procedure improvements rather than maximizing new 
technologies and advanced procedures, as recommended by the task force. According to 
FAA officials, the Agency has taken this approach to avoid potentially extensive 
environmental reviews and accommodate all airspace users, not just those equipped to fly 
advanced procedures. However, nearly half of all active commercial aircraft are currently 
equipped to fly advanced procedures, and representatives from air carriers who are 
equipped stated that FAA's approach offers little operational and financial benefits to 
airlines. In addition, FAA has not yet integrated efforts from other related initiatives, such 
as better managing airport surface operations, into the metroplex initiative. As a result, 
airspace users are concerned about the pace and execution of the metroplex effort, as well 
as the lack of clearly defined expected benefits, and remain reluctant to equip with new 
avionics. 

FAA also has not yet resolved various barriers to its metroplex effort— which have slowed 
other NextGen initiatives. These include working across diverse Agency lines of business, 
updating policies, streamlining the process for implementing new flight procedures, 
applying environmental regulations, upgrading controller automation tools, and training 
controllers on new advanced procedures. FAA is working to address our August 2012 
recommendations to effectively implement the task force's recommendations and resolve 
these barriers in a timely manner. 

Mitigating Risks That Delays With the En Route Automation Modernization 
Program Pose to Critical NextGen Initiatives Increasing airspace capacity and 
reducing flight delays depend on the successful implementation of the En Route 
Automation Modernization program (ERAM)— a $2.1 billion system to replace hardware 
and software at FAA's facilities that manage high-altitude traffic. FAA originally planned to 
complete ERAM by the end of 2010. However, software problems have impacted the 
system's ability to safely manage and separate aircraft and raised questions as to what 
capabilities ERAM will ultimately deliver. FAA rebaselined the program in 2011, which 
pushed its expected completion to 2014 and increased cost estimates by $330 million. FAA 
is taking steps to get ERAM on track and is using the system on a full-time basis at several 
sites— a significant step forward given the extensive software problems during testing at the 
two initial sites. Recent progress at those two sites has allowed FAA to phase out their 
legacy air traffic control systems. However, other facilities continue to identify software 
problems, and FAA will likely encounter these and other issues when it implements ERAM at 
some of the Nation's busiest facilities. If software problems persist, the program's cost 
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growth could exceed $500 million, and delays could stretch out to 2016. Prolonged delays 
with ERAM will directly impact the overall cost and pace of NextGen. Without ERAM, the 
benefits of several other programs, such as a new satellite-based surveillance system and 
data communications for controllers and pilots, will not be possible. 

Making Decisions on Facility Consolidation and Modernization FAA has not 

made key decisions on the number and locations of air traffic facilities needed to support 
NextGen or on the level of automation that can be realistically and safely achieved to 
manage traffic. In November 2011, FAA formalized an initial plan for consolidating en route 
centers and Terminal Radar Approach Control facilities (TRACON) 1 into large, integrated 
facilities in six geographic segments across the country. Since then, the Agency has focused 
on plans in the New York area but has delayed a final decision until May 2013 on where to 
build the integrated facility. Ultimately, successfully implementing FAA's plans will require 
the Agency to address challenges with cost estimates, funding sources, and workforce 
issues. 

Consolidation will likely be a long-term challenge for FAA, as its NextGen modernization 
plans were based on the traditional facility set-up of en route centers and TRACONs— not 
integrated facilities. Integrating facilities will also require cost and schedule changes to 
modernization programs that already have established baselines. The Terminal Automation 
Modernization and Replacement program alone involves about $1 billion through 2018 to 
replace aging displays and processors that controllers rely on to manage takeoffs and 
landings, the most critical phases of flight. FAA recently approved plans to begin 
transitioning to a new terminal automation system at 11 large TRACON facilities through 
2017. However, the Agency has yet to determine whether its consolidation efforts will 
impact these facilities. 

Completing an Integrated Master Schedule for NextGen Transformational 
Programs FAA has not established total program costs, schedules, or performance 
baselines for any of the NextGen six transformational programs. 2 Rather, the Agency plans 
to approve these programs in shorter, discrete segments to minimize risks in the short 
term. However, as requirements continue to evolve, programs are left with no clear end- 
state, and decision makers lack sufficient information to assess progress. Further, FAA has 
not completed an integrated master schedule for deploying the transformational programs 
in response to our April 2012 recommendation. Due to these programs' complex 
interdependences, it will therefore be difficult to fully address operational, technical, and 
programmatic challenges without a master schedule. While FAA is beginning to capture the 
critical activities required to deliver the six programs' operational capabilities, the Agency is 
still working to identify what type of data it needs, such as key system dependencies, to 
complete the master schedule. 



1 En route centers guide airplanes flying at high altitudes through large sections of airspace, while TRACONs guide aircraft 
as they approach or leave airspace within 40 miles of an airport. 

2 These six programs are Automatic Dependent Surveillance Broadcast (ADS-B), System Wide Information Management 
(SWIM), Data Communications (DataComm), NextGen Network Enabled Weather (NNEW), NAS Voice System (NVS), and 
Collaborative Air Traffic Management Technologies (CATM-T). 
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Achieving Expected Outcomes From Reorganization To Improve NextGen 
Management Many of FAA's difficulties with implementing NextGen stem from 
underlying management challenges, such as assigning responsibility, accountability, and 
authority. In 2011, FAA commissioned an internal study to examine how the Agency's 
internal structure, processes, and management culture could be improved to support 
NextGen. Based on the study's recommendations, FAA announced a major reorganization in 
2011 to better position NextGen for success. FAA elevated the former NextGen office- 
creating an Assistant Administrator for NextGen who reports directly to the FAA Deputy 
Administrator— and established a new Program Management Office. This new office will 
also work to bridge the gap between strategic requirements and program implementation. 
FAA is still in the early stages of this reorganization, and work remains to establish best 
practices and institutionalize changes. 

Integrating Unmanned Aircraft Systems in the National Airspace System The 

application of Unmanned Aircraft Systems (UAS) 3 in the United States for research, law 
enforcement, private sector, and State government needs continues to grow. FAA predicts 
there will be roughly 10,000 active commercial UAS in 5 years, with industry investing over 
$89.1 billion in UAS technology over the next 10 years. The FAA Modernization and Reform 
Act of 2012 4 requires the Secretary of Transportation to develop a comprehensive plan that 
will safely and fully integrate UAS into the NAS no later than September 30, 2015. The law 
also requires FAA to establish a program to integrate UAS into the NAS at six test ranges by 
late summer 2012, but FAA has not completed this requirement. This will be a challenge for 
FAA as, historically, UAS have mainly supported military and security operations overseas, 
and FAA has approved operations in the United States on a limited, case-by-case basis. 
Additionally, according to FAA officials, concerns over individual privacy (e.g., collecting 
information for commercial and law enforcement purposes) have contributed to delays in 
implementing the law's requirements, such as issuing a rulemaking to allow use of small 
UAS. With increased usage of UAS comes increased risk to the NAS. While UAS capabilities 
have improved, their ability to detect, sense, and avoid other air traffic is limited. FAA must 
continue to work with other Federal agencies and the aerospace industry to address 
challenges such as certification standards and privacy concerns. Given the growing interest 
and unresolved safety issues associated with UAS flights, FAA and DOT will need to act 
quickly to safely integrate them into the NAS and align those changes carefully with 
NextGen implementation. 



3 An Unmanned Aircraft System (UAS) is comprised of a pilotless aircraft, satellite or radio link, and ground control station 
where an operator controls the movements of the aircraft. UAS aircraft range in size from those with a wingspan as 
large as a Boeing 737 to smaller than a radio-controlled model airplane. UAS can serve diverse purposes, such as 
conducting military operations, enhancing border security, and monitoring forest fires. 

4 FAA Modernization and Reform Act of 2012, Pub. L. No. 112-95 (2012). 
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Related Products The following related documents can be found on the OIG Web site at 
http://www.oig.dot.gov . 

• Challenges With Implementing Near-Term NextGen Capabilities at Congested Airports 
Could Delay Benefits, August 1, 2012 

• The Success of FAA's Long-Term Plan for Air Traffic Facility Realignments and 
Consolidations Depends on Addressing Key Technical, Financial, and Workforce 
Challenges, July 17, 2012 

• Status of Transformational Programs and Risks to Achieving NextGen Goals, 
April 23, 2012 

• The Federal Aviation Administration's Progress and Challenges in Developing and 
Transitioning to the Next Generation Air Transportation System, October 5, 2011 



For more information on the issues identified in this chapter, please contact 
Jeffrey B. Guzzetti, Assistant Inspector General for Aviation and Special 
Program Audits, at (202) 366-0500. 
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Enhancing FAA's Oversight and Use of 
Data To Identify and Mitigate Safety 
Risks 




Source: Federal Aviation Administration 



The U.S. air transportation system continues to be among the safest in the world, due in 
part to the efforts of the Federal Aviation Administration (FAA) and the aviation industry. To 
help sustain that record, it will be important to constantly improve how key data are 
reported, analyzed, and used to enhance safety, oversight, and efficiency. Our audit work 
shows a number of areas where FAA can make improvements to bolster these and other 
oversight efforts. 

Key Challenges 

• Identifying trends in operational errors and determining their root causes 

• Advancing oversight by implementing the Airline Safety Act of 2010 

• Providing more rigorous risk-based oversight of repair stations and identifying inspector 
staffing requirements 

• Identifying the effects of air traffic controller scheduling on safety, cost efficiency, and 
controller performance 
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Identifying Trends in Operational Errors and Determining Their Root Causes 

FAA must make better use of data on operational errors 5 to investigate incidents, identify 
trends, and mitigate their risks. Reported operational errors increased by 53 percent (1,234 
to 1,887) between fiscal years 2009 and 2010. This number remained relatively unchanged 
between fiscal years 2010 and 2011 (rising to 1,895), but the most serious reported errors 6 
continued to increase. FAA reports that these rose by 49 percent from fiscal year 2009 to 
fiscal year 2011 (from 37 to 55, respectively). What remains unclear is whether reported 
increases are due to more errors being committed, improved reporting, or both. FAA 
attributes the increase between fiscal years 2009 and 2010 to increased reporting through 
programs such as the Air Traffic Safety Action Program (ATSAP) 7 and greater use of 
automated reporting tools. However, FAA facilities that manage high-altitude traffic (Air 
Route Traffic Control Centers) had a 39-percent spike in operational errors during that time. 
These centers have had an automated system 8 in place for years to detect and investigate 
each reported error, which suggests that at least a portion of the increase is likely due to 
actual errors occurring. 

To identify root causes of safety problems and mitigate their risk, FAA needs to fine-tune its 
approach to how it collects, verifies, and uses safety data. In July 2012, we identified control 
and oversight weaknesses in how FAA reports and investigates operational errors 
associated with ATSAP. FAA fully deployed ATSAP at all air traffic control facilities in 2010. 
However, to realize ATSAP's full potential, FAA must close program gaps, such as a lack of 
formal processes to review committee decisions on errors, and enforce key ATSAP 
guidelines and requirements. Failure to address these and other deficiencies not only 
undermines efforts to improve safety in the National Airspace System but also may lead to 
the perception that ATSAP is an amnesty program that automatically accepts reports of 
serious incidents, regardless of whether they qualify. 

In January 2012, FAA issued new policies and procedures for collecting, investigating, and 
reporting separation losses, but their effectiveness is limited by incomplete data and 
implementation challenges. Specifically, FAA lacks an accurate baseline on the number of 
separation losses due to its limited use and review of the Traffic Analysis and Review 
Program 9 data, gaps in ATSAP reporting, 10 and inconsistent classification of separation 
losses. Moreover, FAA's new policies transfer the function of investigating operational 
errors from the facilities where they occur to the three Air Traffic Organization Service 
Areas. Facility managers raised concerns about whether the Service Areas have enough staff 
and knowledge of local flight procedures to successfully carry out this responsibility. Finally, 
the mitigation strategy for operational errors included in the new policies lacks previously 

5 Losses of standard separation between aircraft due to air traffic controller error. 

6 Before fiscal year 2011, FAA tracked operational errors in terms of an A, B, C severity rating— with A being the highest or 
"severe" risk and C the lowest. An "A" rating meant that less than 34 percent of separation standards were met. 

7 ATSAP is a voluntary non-punitive reporting program to encourage FAA air traffic employees to report safety events and 
safety concerns, with the intent of capturing all events that might lead to a breakdown in safety. 

8 The Operational Error Detection Program (OEDP) at air route traffic control centers automatically generates an alert 
when a potential loss of separation is detected. 

9 TARP is an automated system that detects losses of separation that occur in terminal airspace. 

10 Due to ATSAP provisions designed to protect controller confidentiality, much of the ATSAP data that FAA collects are not 
validated. 
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identified causal factors, trends, and follow-up actions to address them— all considered to 
be key elements for mitigating the highest safety risks. 

Advancing Oversight by Implementing the Airline Safety Act of 2010 The fatal 
Colgan Air crash in 2009 highlighted the need for improvements in pilot training, hiring and 
qualification programs as well as consistent safety standards between carriers. Congress 
and FAA took swift action following the crash to address these issues, culminating in the 
August 2010 passage of the Airline Safety and FAA Extension Act. 11 FAA has made important 
progress on many of the Act's requirements, such as advancing voluntary safety programs, 
improving pilot rest requirements, and establishing better processes for managing safety 
risks. Despite this progress, FAA has not met the Act's timelines for raising pilot training 
standards, implementing mentoring programs, or providing enhanced leadership skills to 
captains. FAA also missed the Act's deadline to substantially raise airline pilot qualifications 
by August 2012. Effectively implementing this new rule will require FAA to ensure carriers 
are ready to transition to the Act's enhanced pilot qualification requirements before August 
2013, when they automatically take effect. FAA also faces challenges in establishing a pilot 
records database— an important component to enhance the air carrier screening process 
for pilot applicants. In addition, FAA has yet to provide sufficient guidance and assistance to 
industry— especially smaller carriers— in developing and managing new safety programs. 

Providing More Rigorous Risk-Based Oversight of Repair Stations and 
Identifying Inspector Staffing Requirements Major air carriers increased spending 
on contracts for aircraft maintenance by more than $1.7 billion over the past decade. This 
trend is expected to grow as carriers continue to shift away from in-house maintenance to 
save costs. In 2007, FAA implemented a risk-based oversight system to help inspectors 
target surveillance to repair facilities with higher risks. However, our ongoing work shows 
that this system does not include accurate or timely risk assessments of foreign and 
domestic repair stations. In addition, FAA has yet to provide inspectors with comprehensive 
data needed for analytical reviews of repair station performance. Instead, FAA inspectors 
typically rely on their personal knowledge of repair stations to conduct oversight, rather 
than using comprehensive and standardized procedures for conducting and communicating 
the results of inspections. As a result of these weaknesses, FAA's oversight lacks the rigor 
needed to identify deficiencies and verify corrective actions. 

At the same time, FAA has not developed a reliable process for placing inspectors where 
they are most needed. A 2006 National Research Council study conducted at the direction 
of Congress concluded that FAA's methodology for allocating its 4,300 aviation safety 
inspectors was ineffective and recommended that FAA develop a new approach. In 
response, FAA completed a new staffing model in October 2009. Our ongoing work shows 
that FAA's model does not effectively project staffing needs due largely to incomplete and 
inaccurate data. While FAA has reported the results of the model five times since 2009, the 
Agency has not fully relied on the model results when requesting additional inspectors 
during the annual budget process. FAA must further refine this tool so that it more 
effectively allocates inspector resources. 



Airline Safety and Federal Aviation Administration Extension Act of 2010, Pub. L. No. 111-216 (2010). 
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Identifying the Effects of Air Traffic Controller Scheduling on Safety, Cost 
Efficiency, and Controller Performance A series of high-profile incidents in early 
2011 involving controllers who were sleeping on duty sparked public concern about 
controller fatigue. As a result, in April 2011, FAA instituted a series of policy changes, 
including placing an additional air traffic controller on the midnight shift at certain facilities 
and mandating a minimum of 9 hours off between evening and day shifts. As directed by 
the FAA Modernization and Reform Act of 2012, 12 we are assessing these new controller 
scheduling practices. The Act mandated that our assessment include an analysis of how air 
traffic controller schedules are determined, how safety was considered when schedules are 
developed, the cost effectiveness of scheduling practices, and how scheduling practices 
impact air traffic controller performance. The implementation of this new policy is an 
important watch item for DOT, FAA, and Congress. 

Related Products The following related documents can be found on the OIG Web site at 
http://www.oig.dot.gov . 

• Long Term Success of ATSAP Will Require Improvements in Oversight, Accountability, 
and Transparency, July 19, 2012 

• The State of Aviation Safety and FAA's Oversight of the National Airspace System, 
April 25, 2012 

• Progress and Challenges in Responding to Key Provisions of the Airline Safety Act, 
March 20, 2012 

• Progress and Challenges With FAA's Call to Action for Airline Safety, February 4, 2010 

• Air Carriers' Outsourcing of Aircraft Maintenance, September 30, 2008 

• Review of Air Carriers' Use of Aircraft Repair Stations, July 8, 2003 



For more information on the issues identified in this chapter, please contact 
Jeffrey B. Guzzetti, Assistant Inspector General for Aviation and Special 
Program Audits, at (202) 366-0500. 



FAA Modernization and Reform Act, Pub. L. No. 112-95 (2012). 
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Overseeing Administration of Key 
Transportation Assets To Ensure Their 
Success and Susta inability 




Source (from top left to bottom right): Dulles International Airport, Reagan National Airport, Dulles Corridor 
Rail, Dulles Corridor— Phase 2, Union Station, and United States Merchant Marine Academy. 



The Department owns or invests in several key transportation assets. These include the 
Metropolitan Washington Airports Authority (MWAA), which operates the region's two 
largest airports 13 — Ronald Reagan Washington National and Dulles International— and is 
also responsible for a massive public transportation expansion; Union Station, the main 
multi-modal transportation hub in Washington, DC; and the United States Merchant Marine 
Academy (the Academy) in New York. We have recent and ongoing work evaluating DOT's 
management practices for these critical assets due to recent concerns raised by Congress or 
other stakeholders to our office. Our audits highlight the need for the Department to 
improve its oversight of these assets to ensure their success and sustainability. 



MWAA operates these airports, their access highways, and other related facilities under the terms of a lease agreement 
with DOT authorized by the Metropolitan Washington Airports Act of 1986 (Pub. L. No. 99-591) and an interstate 
compact between the Commonwealth of Virginia and the District of Columbia. 
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Key Challenges 

• Enforcing reforms to MWAA's operating and contracting practices 

• Overseeing the management of Washington, DCs Union Station 

• Protecting the Academy's sensitive information and systems 

Enforcing Reforms to MWAA's Operating and Contracting Practices MWAA 
operates two major federally owned airports and is also responsible for designing, 
constructing, and partially financing the Dulles Corridor Metrorail Project— a two-phased, 
multibillion-dollar effort to expand DC Metrorail service in Northern Virginia and provide 
easier access to Dulles Airport. 14 Therefore, MWAA's decisions greatly impact the DC region 
and its residents. Since its creation, MWAA and its Board of Directors have made substantial 
improvements to the region's airports. Yet, MWAA has recently been the subject of 
controversy and debate regarding its policies, contracting practices, and governance issues. 
In a May 2012 letter to Congressmen Wolf and Latham, we raised concerns that MWAA's 
accountability to Congress, stakeholders, and the public— as well as compliance with the Act 
transferring operation of the airports— has been limited by weaknesses in its internal 
policies and oversight of those policies. In particular, policies and procedures for Board 
travel, ethics, and transparency were found to be insufficient to ensure fiduciary and ethical 
responsibility in the Board's expenses and activities. For example, MWAA's policy does not 
provide suggested limits or thresholds for business-related Board travel expenses, such as 
food, beverages, and flights. We identified one instance in which Board members and their 
guests spent $4,800 on meals during a trip to Hawaii for a conference. 

Similarly, MWAA's contracting policies and practices do not ensure compliance with laws 
and MWAA's procedures, resulting in contracts that are not subject to full and open 
competition and may not represent best value. For example, MWAA's Board of Directors 
authorized categorical exceptions to full and open competition for items such as legal 
services, urgent need, or financial services. 15 MWAA awarded almost two-thirds 
(64 percent) of its 190 contracts that exceeded $200,000 with less than full and open 
competition during the period of our review. 16 Of these, 117 contracts were awarded using 
categorical exceptions, which amounted to more than $220 million. 

In response to our letter, the Secretary, the Governors of Maryland and Virginia, and the 
Mayor of the District of Columbia issued a letter to MWAA's Chairman and Board 



This Project entails adding a 23-mile extension to DCs Metrorail system. This extension, to be known as the "Silver 
Line," will connect the Metrorail system to the Washington Dulles International Airport and Loudon County, Virginia. 
The six categorical exceptions established in section 1.2 of MWAA's Contracting Manual include (1) limited competition 
for urgent needs; legal, financial, audit, or legislative representation professional services; and local business set asides; 
(2) airport security controlled distribution RFP; (3) utility supplies and services; (4) Government purchasing agreements; 
(5) airline tenant procured projects; and (6) proprietary equipment and software. Use of these exceptions requires no 
further Board approval. 

We reviewed contracts awarded between January 2009 and June 2011. 
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members mandating immediate reform to MWAA's business practices. Reforms include 
tightening Board travel procedures to eliminate wasteful spending, strengthening MWAA's 
ethics code to guard against conflicts of interest and provide annual ethics training to Board 
members and employees, and terminating all existing contracts with former Board 
members that were not competitively bid. In addition, the Secretary appointed an 
Accountability Officer to ensure those reforms would be instituted immediately. As stated 
in our November 2012 report, while MWAA has taken positive steps to correct the 
deficiencies we identified— including revising its travel and ethics policies and suspending 
contracts with former Board members— significant weaknesses remain that leave the 
Authority vulnerable to criticism for its contracting practices and management oversight. 
Our work found, among other things, that the Authority's existing ethics-related 
procedures 18 have been insufficient to detect violations of anti-nepotism and gift 
provisions. For example, one senior official indirectly supervised family members despite 
the code's explicit provision prohibiting such relationships. Another senior official regularly 
accepted inappropriate gifts from an MWAA contractor— including Super Bowl tickets, 
travel, and accommodations worth almost $5,000. Enhanced policies, strong internal 
controls, and robust oversight in the areas of procurement, 19 ethics, hiring and 
compensation, and transparency will be critical to maintain and improve the Authority's 
operations and restore public trust in the soundness of its current and future activities. The 
Department will also need to consider devising and adopting enforcement mechanisms to 
ensure that the remaining weaknesses we identified are addressed. 

Overseeing the Management of Washington, DCs Union Station Washington's 
historic Union Station, built over a century ago, provides rail, bus, and Metro access into the 
heart of the city and is a major tourist destination. In 1983, after years of neglect, the 
Department created the non-profit Union Station Redevelopment Corporation (USRC) to 
oversee and complete facility rehabilitation. 20 While DOT's Federal Railroad Administration 
(FRA) owns the Station, USRC is charged with managing and protecting Federal interests in 
the property. For the past 25 years, USRC has successfully funded basic maintenance and 
improvements with revenue from the Station's parking facilities and leased space. However, 
Union Station and USRC now face financial challenges that may exceed USRC's ability to 
self-finance and require the Department's intervention. These challenges include projecting 
expected outlays and developing a financing plan to ensure payment of the following: 

• DC Possessory Interest Taxes totaling approximately $9 million in back taxes and almost 
$1 million annually thereafter 

• outstanding debt from financing a garage expansion project totaling $29 million 



Letter to Michael A. Curto, Chairman and Members of the Board of Directors, Metropolitan Washington Airports 
Authority, August 14, 2012. 

MWAA recently approved a new employee code of ethics that will go into effect on January 1, 2013. 

Based on FTA's Procurement System Review, MWAA's Board of Directors recently adopted changes to its Procurement 

Manual to be in line with FTA procurement requirements. However, we have not reviewed MWAA's implementation of 

these FTA-required changes because they are so recent. Also, our audit review and findings are broader than the FTA 

grant rules and apply to MWAA contract policies and practices for all of its contracts. 

Total rehabilitation costs were approximately $200 million. 
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• damages from the August 2011 earthquake currently estimated between $10 million 
and $12 million 

• planned repairs and improvements through 2016 estimated at $40 million or more 

• other structural issues and safety and security upgrades under consideration 

USRC and FRA need to take a thorough look at the condition and emerging needs of Union 
Station; develop a comprehensive master plan that includes the needed repairs, upgrades, 
and improvements; and develop funding streams for these requirements before the facility 
deteriorates or becomes a safety concern. 

Protecting the Academy's Sensitive Information and Systems The Academy- 
operated by the Department's Maritime Administration (MARAD)— is responsible for 
training shipboard officers for the U.S. Merchant Marine. As an institution of higher 
education, the Academy possesses sensitive information, including personally identifiable 
information (Pll). 21 For example, the Academy uses a local area network (LAN) and Web site 
for several purposes, including the acceptance of student applications and maintenance of 
student grade records. Federal law and DOT policy require the Academy to implement 
security controls to protect the information and systems. 22 

In our May 2012 audit, we reported that the Academy's security controls were insufficient 
to protect its Web site and LAN from compromise, as the Academy had not implemented 
Federal and DOT security requirements. For example, the Academy's databases containing 
Pll had poor user access controls. As a result, the Academy ran the risk of intruders gaining 
unauthorized access to a large amount of sensitive information stored in its system without 
detection or response from the Academy. We also identified a need for increased 
accountability and culture change as it pertains to information security. For example, we 
noted that the Academy did not enforce controls over student laptops connected to its LAN 
and did not discipline students for using the LAN in ways that increased security risks, such 
as accessing adult content. The Department will need to increase oversight of MARAD and 
the Academy to protect their information and systems. 



Pll is any information about an individual maintained by an agency, including, but not limited to, education, financial 
transactions, medical history, and criminal or employment history and information that can be used to distinguish or 
trace an individual's identity, such as their name, and social security number. 
22 As required by the Federal Information Security Management Act of 2002 and the Departmental Cybersecurity Policy, 
DOT Order 1351.37, July 7, 2011. 
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Related Products The following related documents can be found on the OIG Web site at 
http://www.oig.dot.gov . 

• MWAA's Weak Policies and Procedures Have Led to Questionable Procurement 
Practices, Mismanagement, and a Lack of Overall Accountability, November 1, 2012 

• The U.S. Merchant Marine Academy's Security Controls Were Not Sufficient To Protect 
Sensitive Data from Unauthorized Access, May 30, 2012 

• Interim Response Letter to Congressmen Wolf and Latham Regarding MWAA, 
May 15, 2012 



For more information on the issues identified in this chapter, please contact 
Louis C. King, Assistant Inspector General for Financial and Information 
Technology Audits, at (202) 366-1407; Jeffrey B. Guzzetti, Assistant Inspector 
General for Aviation and Special Program Audits, at (202) 366-0500; or 
Mary Kay Langan-Feirson, Assistant Inspector General for Acquisition and 
Procurement Audits, at (202) 366-5225. 
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Strengthening Existing Surface Safety 
Programs and Effectively Implementing 
New Safety Requirements 




Source: Department of Transportation 

The Department's top priority is to make our transportation system safer. While fatalities 
on the Nation's highways have declined by over 25 percent since 2005, 23 the safety of 
highways, railroads, and pipelines remains an ongoing concern. The Department faces a 
significant challenge to continually improve and oversee the Nation's surface transportation 
systems that are critically important to efficiently move people and energy sources, 
promote interstate commerce, and grow the U.S. economy. A key component of 
departmental oversight will be implementation of new safety requirements enacted in the 
Moving Ahead for Progress in the 21st Century Act of 2012 (MAP-21). 



24 



Key Challenges 

• Following through on initiatives to improve the National Highway Traffic Safety 
Administration's oversight of vehicle safety defects 



• Enhancing motor carrier safety oversight 

• Implementing new rail transit safety oversight requirements 

• Developing a new national tunnel safety program 

• Effectively addressing expanded railroad safety oversight responsibilities 

• Providing more rigorous oversight of pipeline safety programs 



Based on September 2012 NHTSA data on actual or projected fatalities through 2011. NHTSA also reported that its 
statistical projection of traffic fatalities for the first half of 2012 shows an estimated 9-percent increase in fatalities over 
the number projected to have occurred in the first half of 2011. 

Moving Ahead for Progress in the 21st Century, Pub. L. No. 112-141 (July 2012), §32701-32711. 
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Following Through on Initiatives To Improve the National Highway Traffic 
Safety Administration's Oversight of Vehicle Safety Defects Vehicle defects, 
particularly unintended acceleration, have brought significant public, media, and 
congressional attention to the National Highway Traffic Safety Administration's (NHTSA) 
oversight of vehicle safety. Our 2011 audit work found the need for process improvements 
within NHTSA's Office of Defects Investigation, particularly with establishing standard 
operating procedures for storing investigative records and documenting evidence. NHTSA 
also needs to assess its workforce to determine if it has enough staff and expertise to 
operate effectively. A key component of these efforts should be a formal training program 
for investigative staff to keep them apprised of defect identification processes and new 
technologies that could impact their work. NHTSA must also take specific steps to meet 
MAP-21 requirements, which include publishing motor vehicle safety recall information and 
developing regulations that direct manufacturers to affix guidance on passenger motor 
vehicles on how to submit defect complaints to NHTSA. 

Enhancing Motor Carrier Safety Oversight Large truck and bus crashes and fatalities 
have increased and therefore remain a key safety issue. 25 Over the past year, the Federal 
Motor Carrier Safety Administration (FMCSA) took actions to remove unsafe commercial 
drivers and carriers, including motor coach companies. FMCSA also implemented a more 
stringent safety assurance process that new entrants must complete. However, it has yet to 
address two action items raised by our office and the National Transportation Safety Board 
(NTSB): (1) implement promised checks on whether U.S. -based commercial vehicles display 
proof of compliance with manufacturing standards and (2) issue a new regulation tightening 
controls over the leasing of buses. FMCSA should also collaborate with NHTSA on new MAP- 
21 provisions to strengthen motor coach safety and carry out MAP-21 provisions on safety 
reviews, commercial driver's license endorsements, and inspections. 

MAP-21 also provided FMCSA with a critical new oversight tool by allowing it to revoke the 
registration of reincarnated carriers 26 — a safety concern we reported in April 2012. FMCSA 
revised its vetting process to identify reincarnated carriers applying for authority to 
transport passengers and household goods. However, before FMCSA expands the vetting 
process to all new motor carrier applicants, it will need to implement a risk-based approach 
to best target its limited vetting resources. FMCSA must also effectively implement its newly 
updated policies on placing reincarnated carriers out of service and reviewing and 
approving applications for operating authority. 

Implementing New Rail Transit Safety Oversight Requirements MAP-21 
enhanced the Federal Transit Administration's (FTA) authority to oversee the safety of the 
Nation's public transportation systems. By October 1, 2013, FTA must initially determine 
whether to certify that each State that has a State Safety Oversight agency has a State 
safety oversight plan in compliance with MAP-21 requirements. This will require FTA to 



From 2009 to 2011, large truck and bus crashes increased by 8.4 percent and associated fatalities increased by 
5.7 percent. 

Motor carriers that attempt to operate as a different entity in an effort to evade enforcement action, out-of-service 
orders, or both. 
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establish safety performance criteria, vehicle safety performance standards, safety 
certification training for covered personnel, and plans for each transit agency to reduce 
safety risks. 

FTA will face significant challenges in carrying out these new requirements. As our prior 
work shows, FTA should obtain sufficient data on attributes such as fatalities, injuries, and 
transit assets. It should also work expeditiously to establish rail transit-specific goals and 
performance measures to assess the impact of its new safety efforts. Additionally, FTA 
should issue timely guidance to State Safety Oversight agencies, prioritize the greatest 
safety risks for any rulemakings, enlist leadership commitment to expedite these 
rulemakings, and periodically review and revise regulations. 

Developing a New National Tunnel Safety Program The Federal Highway 
Administration (FHWA) must meet new MAP-21 requirements to establish a national tunnel 
inspection program and a tunnel inventory. This program would mirror the national bridge 
inspection program and bridge inventory and would require States to inspect and 
periodically report on the condition of the Nation's tunnels. FHWA has begun developing 
tunnel inspection standards, which were included in a proposed rule issued in 2010. 27 
FHWA also developed guidance for tunnel design, construction, rehabilitation, and 
inspection that may be adopted as standards. 

To fully implement the MAP-21 provisions and promote consistent application of tunnel 
safety standards, FHWA must take a number of steps. These include issuing regulations that 
clearly specify what constitutes a tunnel, ensuring its baseline inventory of highway tunnels 
is accurate, and establishing a process to assess inspection data. Finally, tunnel inspections 
may demand specialized engineering skills not readily available in FHWA and State DOT 
offices. Therefore, it will be critical for FHWA to develop a training and certification program 
to help FHWA and State DOT offices recruit and train the staff needed to implement new 
tunnel safety standards. 

Effectively Addressing Expanded Railroad Safety Oversight Responsibilities 

The Federal Railroad Administration (FRA) faces an ongoing challenge in carrying out its 
expanded regulatory role under the Rail Safety Improvement Act of 2008 (RSIA). 28 Congress 
passed RSIA after several high-profile railroad accidents between 2002 and 2008 and 
projections of rail traffic increases that could result in higher accident rates over the next 
10 years. RSIA was the first reauthorization of the Federal Rail Safety program since 1994. 

RSIA requires FRA to undertake a variety of actions, ranging from development of a long- 
term safety strategy to completion of scientific studies. The largest subset of these 
requirements directs FRA to develop 17 new safety regulations for the railroad industry. 
These new regulations govern a wide variety of areas, such as hours of service requirements 
for railroad workers, automated collision-prevention technology, standards for track 
inspections, and safety at highway-rail grade crossings. As of July 1, 2012, FRA had 



FHWA plans to issue a supplemental proposed rule in 2013 incorporating MAP-21 changes. 
Pub. L. No. 110-432 (2008). 
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completed 9 of the 17 regulations required by RSIA. In addition to completing these, FRA 
faces the challenge of developing guidance for its oversight staff to oversee industry 
compliance with the new safety regulations. FRA publishes compliance manuals to provide 
guidance to its inspectors and the railroad industry on the application of safety regulations. 
However, the Agency failed to finalize compliance manuals for the new RSIA regulations 
before its inspectors initiated oversight activities for those regulations. 

Providing More Rigorous Oversight of Pipeline Safety Programs Several tragic 
pipeline accidents over the past few years have highlighted the need for the Pipeline and 
Hazardous Materials Safety Administration (PHMSA) to enhance its oversight of pipeline 
operators. Of particular concern are operators' integrity management programs, intended 
to reduce the likelihood and severity of pipeline accidents in highly populated or otherwise 
sensitive areas (known as High Consequence Areas). 29 

NTSB and our office have reported on weaknesses in this aspect of PHMSA oversight. In its 
investigation of the 2010 San Bruno, CA, pipeline explosion, 30 NTSB questioned the 
operator's implementation of its integrity management programs. NTSB raised concerns as 
to the effectiveness of inspection protocols PHMSA used to assess operators' compliance 
with their performance-based safety programs. NTSB recommended that the Secretary 
perform a top-to-bottom review of PHMSA's processes and procedures used to oversee 
operators' integrity management program compliance. In response, the Secretary and 
PHMSA agreed that PHMSA's Senior Policy Advisor would conduct this review, which is now 
underway. 

In June 2012, we similarly reported vulnerabilities in PHMSA's oversight and enforcement of 
operators' compliance with their integrity management programs, specifically in regard to 
hazardous liquid pipelines. While PHMSA has several efforts underway to enhance its 
integrity management inspection program, the Agency faces challenges that impact its 
oversight. These include managing a growing backlog of inspections, identifying integrity 
management weaknesses through field inspections and onsite accident investigations, and 
transitioning to a new risk-based inspection program. In addition, PHMSA's integrity 
management requirements for operators' facilities (such as valves, pump and meter 
stations, and storage tanks) have not kept pace with recent technological advances that 
would enhance oversight at such facilities. Finally, the Agency has not yet resolved key data 
management deficiencies, such as insufficient quality checks for pipeline data, or 
established meaningful performance measures for its integrity management program. 



High Consequence Areas include unusually sensitive areas (defined as drinking water or ecological resource areas), 
urbanized and other populated places, and commercially navigable waterways. 
30 On September 9, 2010, a 54-year old gas pipeline exploded in San Bruno, CA, killing 8 people and destroying 38 homes. 
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Related Products The following related documents can be found on the OIG Web site at 
http://www.oig.dot.gov . 

• Hazardous Liquid Pipeline Operators' Integrity Management Programs Need More 
Rigorous PHMSA Oversight, June 18, 2012 

• Timely and Targeted FMCSA Action Is Needed To Fully Address National Transportation 
Safety Board Recommendations for Improving Passenger Carrier Oversight, 
April 17, 2012 

• Challenges to Improving Oversight of Rail Transit Safety and Implementing an Enhanced 
Federal Role, January 31, 2012 

• Process Improvements Are Needed for Identifying and Addressing Vehicle Safety 
Defects, October 6, 2011 

• Statement for the Record: FMCSA Is Strengthening Motor Carrier Safety Oversight but 
Further Action and Attention Are Needed, July 21, 2011 

• Letter to Chairmen Rockefeller and Pryor Regarding Whether Former NHTSA Employees 
Exerted Undue Influence on Safety Defect Investigations, April 4, 2011 



For more information on the issues identified in this chapter, please contact 
Joseph W. Come, Assistant Inspector General for Highway and Transit Audits, 
at (202) 366-5630; Jeffrey B. Guzzetti, Assistant Inspector General for 
Aviation and Special Program Audits, at (202) 366-0500; or Mitch Behm, 
Assistant Inspector General for Rail, Maritime, and Economic Analysis, at 
(202) 366-9970. 
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Maximizing Surface Infrastructure 
Investments With Effective Program 
Oversight and Execution of New 
Legislative Requirements 




Source: California Department of Transportation 



The Federal Highway Administration (FHWA) and the Federal Transit Administration (FTA) 
face challenges in overseeing the billions in Federal funds provided annually to construct 
and maintain the Nation's vast network of roadways and transit systems. In addition, both 
agencies must implement new initiatives enacted in the Moving Ahead for Progress in the 
21st Century (MAP-21) Act of 2012— the first surface transportation authorization since 
2005. MAP-21 places priority on accelerating project delivery and employing performance- 
based investment management. Implementing MAP-21 will require FHWA and FTA to make 
fundamental changes in the way they currently do business. 

Key Challenges 

• Strengthening existing highway and transit project oversight mechanisms 

• Expediting and reforming highway and transit project delivery 

• Transitioning to a system of performance-based and data-driven surface transportation 
investments 
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Strengthening Existing Highway and Transit Project Oversight Mechanisms 

FHWA and FTA have taken actions to improve oversight of highway and transit projects. 
These include adopting processes from FHWA's National Review Teams— an innovation of 
the American Recovery and Reinvestment Act (ARRA) 31 — for future assessments across 
FHWA Division offices and reviewing FTA's regional oversight practices. However, both 
agencies remain challenged to ensure projects meet Federal requirements and maximize 
the return on Federal dollars. 

For highway and bridge investments, States assume much of the oversight responsibility for 
about $40 billion in annual Federal-aid, but FHWA is ultimately responsible for making sure 
that projects meet Federal requirements. However, our work has found a number of areas 
where FHWA can do more to hold States accountable. First, FHWA must follow through on 
promised actions to correct States' insufficient oversight of local public agency (LPA) 
programs— federally funded projects managed by cities, counties, and other local entities. 
For example, more uniform FHWA assessments of LPA deficiencies would help curb 
persistent risks, such as noncompliance with Federal labor requirements and improper 
processing of contract changes. Second, FHWA's Division Offices can more clearly define 
Federal and State oversight roles and responsibilities and identify program risks and 
priorities within the Stewardship and Oversight Agreements they have with States. Finally, 
FHWA will be challenged to ensure States effectively implement new regulations on 
performing value engineering studies during a project's planning or design phase to 
improve project performance, cost, and quality. 

FHWA must also continue to exercise proper stewardship of ARRA funds, which provided 
over $27 billion for highway infrastructure projects in 2009 and established tight time 
frames for using these funds. Last year, the Office of Management and Budget (OMB) 
directed Federal agencies to expedite use of ARRA funds to advance ARRA's major goal of 
stimulating economic activity well before the final deadline of September 30, 2015. As of 
July 1, 2012, the bulk of FHWA's ARRA funds have been spent, but the remaining portion of 
the approximately $2 billion (7.6 percent of ARRA highway funds) may be returned to the 
Treasury if not spent in time. 

FTA has oversight responsibility for approximately $10 billion it provides annually to more 
than 1,300 States and localities, including a large portfolio of major infrastructure projects 
across the country. Our work, done at FTA's request, has identified areas where FTA can 
improve its oversight tools— which rely heavily on contractors— to maximize the return on 
investment. For example, FTA Headquarters must provide its regional offices and oversight 
contractors with enhanced guidance to ensure they consistently identify and accurately 
track deficiencies found during key audits of FTA grantees. Additionally, after our 
assessment of the Dulles Corridor Metrorail Project, FTA recognized that issues we 
identified merited an internal review of its project management oversight contractor 
processes. Timely implementation of these reforms is essential to ensure transit funds are 
appropriately spent. 



American Recovery and Reinvestment Act, Pub. L. No. 111-5 (2009). 
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Expediting and Reforming Highway and Transit Project Delivery A key challenge 
for DOT is to meet new MAP-21 requirements to expedite and reform highway and transit 
projects. Reducing project delivery time has become a national priority, as a typical highway 
project takes an average of 13 years to complete. In addition to tying up resources, long 
project delivery times delay opportunities to reduce highway congestion and improve traffic 
safety. MAP-21 incorporates a specific set of initiatives, such as broadening States' ability to 
acquire or preserve the property needed for a project before completion of lengthy 
environmental impact reviews. To meet MAP-21 requirements, it will be essential that DOT 
build on its agencies' existing initiatives, such as FHWA's "Every Day Counts." This initiative 
focuses on identifying proven project delivery processes and market-ready technologies, 
and encouraging widespread use among States. 

Transitioning to a System of Performance-Based and Data-Driven Surface 
Transportation Investments MAP-21 requires DOT to move toward more performance- 
based investment management of its highway and transit programs. Accordingly, DOT must 
establish new rules and performance standards, link performance data collection to project 
selection and funding processes, and modify oversight mechanisms. DOT will be challenged 
to put performance management into actual practice, as demonstrated by its difficulties 
deploying a performance-based program for its multi-modal Transportation Investment 
Generating Economic Recovery (TIGER) discretionary grant program. Since 2009, DOT has 
worked to require each TIGER grantee to develop and report on outcome-based 
performance measures. However, DOT has yet to develop the methods to make meaningful 
comparisons across diverse transportation modes and assess project impacts. 

Related Products The following related documents can be found on the OIG Web site at 
http://www.oig.dot.gov . 

• Improvements to Stewardship and Oversight Agreements Are Needed To Enhance 
Federal-Aid Highway Program Management, October 1, 2012 

• DOT Established Timely Controls for the TIGER Discretionary Grant Program, but 
Opportunities Exist To Strengthen Oversight, September 20, 2012 

• Improvements Needed in FTA's Grant Oversight Program, August 2, 2012 

• Actions Needed To Improve FTA's Oversight of the Dulles Corridor Metrorail Project's 
Phase 1, July 26, 2012 

• FHWA's Oversight of Federal-Aid and Recovery Act Projects Administered by Local 
Public Agencies Needs Strengthening, July 15, 2011 



For more information on the issues identified in this chapter, please contact 
Joseph W. Come, Assistant Inspector General for Highway and Transit Audits, 
at (202) 366-5630. 
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Adequately Overseeing Administration of 
High Speed Intercity Passenger Rail 
Grant Funds 




Source: Amtrak 



The Passenger Rail Investment and Improvement Act of 2008 (PRIIA) directed the Federal 
Railroad Administration (FRA) to establish a grant program to fund various types of intercity 
passenger rail improvements. FRA has awarded and obligated over 95 percent of 
$10.1 billion in grant funds— $8 billion of which was appropriated by the American Recovery 
and Reinvestment Act of 2009 (ARRA)— to develop and implement the High Speed Intercity 
Passenger Rail Program (HSIPR). While FRA has developed parameters for funding grants, it 
has only disbursed 8 percent of funds to date due to a number of challenges. As more HSIPR 
grantees move to begin project construction, FRA will need to provide clear program 
guidance, comprehensive training, and cohesive program goals and performance measures. 

Key Challenges 

• Approving completed stakeholder agreements to disburse obligated HSIPR funds 

• Addressing staffing needs to provide effective HSIPR Program oversight 

• Overseeing HSIPR Program progress with comprehensive goals, performance measures, 
and monitoring 



P.L No. 110-432, Div. B. 
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Approving Completed Stakeholder Agreements To Disburse Obligated HSIPR 
Funds FRA issued interim HSIPR guidance for grantees and freight companies to outline 
the terms and conditions they must agree on before receiving any Federal funds. These 
agreements cover passenger rail service improvements, construction, and maintenance 
responsibilities. FRA approved completed agreements related to service improvements 
prior to obligation of project funds. Many agreements related to construction and 
maintenance responsibilities are incomplete because stakeholders cannot agree on 
required terms, and FRA's interim guidance does not specify how these terms should be 
addressed. This has required FRA to be more involved in negotiating the agreements to 
clarify its expectations and address disputes among stakeholders, resulting in a more time 
consuming process. If delays with projects' agreements continue, obligated funds will sit 
idle instead of being freed up for projects with completed agreements. As the HSIPR 
Program progresses, FRA will need finalized guidance that provides clear direction to 
grantees on completing required agreements and to applicants on developing project grant 
applications to enable proper evaluations of project viability. FRA plans to issue a Notice of 
Proposed Rulemaking to finalize the guidance within 4 months of receiving new 
appropriated funds from Congress for the HSIPR program. 

Addressing Staffing Needs To Provide Effective HSIPR Program Oversight FRA 

has not fully addressed HSIPR Program staffing and training needs. To date, FRA has filled 
91 percent of the staff positions allocated for its division primarily responsible for HSIPR. 
The Agency recognizes its need to fill remaining vacancies, but it has experienced difficulty 
in recruiting qualified candidates for specialized roles, such as grant managers. Effective 
integration of personnel into these key positions is critical to build the Agency's expertise to 
adequately manage the growing HSIPR program. FRA's recently completed Grants 
Management Manual includes Program policies that will be the basis for a full training 
curriculum, which will focus on grant management practices for project-based staff. The 
Agency plans to issue the curriculum by December 2012. 

Overseeing HSIPR Program Progress With Comprehensive Goals, 
Performance Measures, and Monitoring FRA's HSIPR program lacks clear goals and 
meaningful performance measures needed for decision makers to understand FRA's 
expectations for the Program and FRA's progress in achieving them. For example, one HSIPR 
goal is to upgrade existing intercity passenger rail corridors to improve reliability, speed, 
and frequency of existing services. However, the goal does not include measures that 
indicate progress, such as anticipated trip time improvements, additional trains, and 
ridership gains. In addition, many goals are inconsistent across FRA's planning documents, 
and some cannot be reconciled. It is therefore difficult for FRA to effectively set priorities 
and plan best use of resources. A key step to better define HSIPR program goals— and what 
their outcomes should be— is completion of the congressionally mandated National Rail 
Plan (NRP). The NRP is intended to help States determine how to integrate interstate rail 
planning and address national transportation needs through high speed rail corridors. 
Therefore, once complete, the NRP could greatly aid FRA's efforts to make HSIPR goals 
more cohesive at the State and national levels. To date, however, FRA has been slow in 
implementing the NRP due largely to its focus on obligating funds to grantees. 
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FRA also faces challenges with aspects of HSIPR program monitoring. In March 2012, FRA 
finalized its monitoring plan, which defines timeframes and personnel responsibilities for 
completing scheduled reviews of HSIPR grantees' compliance with grant terms. However, 
FRA still lacks an effective tool to help grant managers accurately track and manage 
grantees' compliance with key documentation requirements, such as those for ARRA 
reporting and certification. 

Related Products The following related documents can be found on the OIG Web site at 
http://www.oig.dot.gov . 

• FRA's Requirements for High Speed Rail Stakeholder Agreements Mitigated Risk but 
Delayed Some Projects' Benefits, November 1, 2012 

• Completing a Grants Management Framework Can Enhance FRA's Administration of the 
HSIPR Program, September 11, 2012 

• FRA Has Made Progress in Implementing PRIIA Responsibilities, but Challenges for Long- 
Term HSIPR Remain, March 6, 2012 



For more information on the issues identified in this chapter, please contact 
Mitch Behm, Assistant Inspector General for Rail, Maritime, and Economic 
Analysis, at (202) 366-9970. 
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Strengthening Financial Management 
Over Grants To Better Use Funds, Create 
J obs, and Improve Infrastructure 




Source: Department of Transportation, Office of Inspector General 



Over the past 5 years, the Department has successfully maintained a clean opinion on its 
financial statements— a commendable step towards good financial management. However, 
DOT could do more to maximize the return on investment for its grants, many of which are 
used to create jobs and improve transportation infrastructure. Our audit work has identified 
financial management weaknesses that allow available grant funds to remain committed to 
projects where they are no longer needed, permit improper payments, and limit the 
benefits of single audits 33 in improving controls over grant spending. Until it addresses 
these weaknesses, DOT will be unable to make the most of its increasingly limited grant 
resources. 

Key Challenges 

• Identifying idle grant funds that can be used for transportation projects 

• Enhancing controls to reduce and recover improper payments 

• Making better use of single audit findings to improve grantees' financial management 
practices 



All non-Federal entities that expend $500,000 or more of Federal awards in a year are required to obtain an annual 
audit in accordance with the Single Audit Act Amendments of 1996 and OMB Circular A-133. OIG performs quality 
control reviews of selected Single Audits covering expenditures of DOT funds in order to determine (1) the adequacy of 
the independent auditors' work, (2) whether the work complied with relevant auditing standards, and (3) the extent to 
which we can rely on the auditors' work. 
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Identifying Idle Grant Funds That Can Be Used for Transportation Projects For 

the past 4 years, the Department's financial statement auditors have recommended that 
DOT strengthen internal controls, de-obligate and close out inactive funds from completed 
projects in a timely manner, and make them available for other priority projects. In 
particular, the financial statement reports and our audit work have identified a significant 
deficiency in DOT's internal controls over Undelivered Orders (UDO). 34 For example, our 
tests of inactive 35 grant UDOs on record as of March 31, 2012, disclosed an estimated 
$1.2 billion in UDOs that the Department can de-obligate. Most of these obligations were 
identified within the Federal Highway Administration (FHWA) and Federal Transit 
Administration (FTA) grant programs. Further, FHWA and FTA policies and procedures for 
monitoring grant obligations use thresholds (e.g., age of obligation) that do not enable 
timely identification of unneeded obligations. We also found many cases where personnel 
did not evaluate obligations that met the policy thresholds. 

On July 11, 2012, the DOT Chief Financial Officer directed all Operating Administrations to 
immediately begin a 60-day, resource-intensive remediation effort to identify and de- 
obligate unneeded UDOs where possible or quantify unneeded UDOs for future corrective 
action. While this is a positive step, it serves only as a short-term solution to correct the 
financial statements as of September 30, 2012. To create a permanent solution to this 
persistent problem, the Department will have to revisit its policies and procedures for 
monitoring grant obligations, identify potential training needs for personnel who monitor 
grants, and enforce compliance with internal controls to enable timelier identification and 
resolution of unneeded obligations. To avoid the need for another short-term, resource- 
intensive remediation effort, the Department must also continually monitor Operating 
Administrations' efforts to reprogram unneeded obligations to projects that will benefit job 
creation and infrastructure development. 

Enhancing Controls To Reduce and Recover Improper Payments Reduction and 
recovery of improper payments are longstanding challenges for DOT. The 2010 Improper 
Payments and Elimination and Recovery Act (IPERA) 36 encourages the elimination of 
payment error, waste, fraud, and abuse in Federal programs. Annually, DOT programs 
provide more than $60 billion in grants to over 3,300 grantees. While DOT has identified 
significant improper payments 37 in FHWA's Federal-Aid Highway Program totaling an 
estimated $450 million, we continue to find additional recoverable improper payments that 
DOT did not identify. For example: 

• In 2010, we reported that the Federal Aviation Administration's (FAA) risk-based grant 
oversight for its Airport Improvement Program (AIP) was not sufficient to prevent or 
detect improper payments. We estimate that there are more than $31 million in 



UDOs represent goods or services ordered, which have not been received prior to the end of the reporting period. Grant 
UDOs represent funding obligated through grantee agreements that have not been disbursed prior to the end of the 
reporting period. 

Our testing focused on grants that had been inactive for at least a year. 
Public Law Number 111-204 (2010). 

IPERA's term 'significant' means that improper payments in the program or activity in the preceding fiscal year may have 
exceeded $100,000,000. 
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recoverable improper payments. In October 2012, FAA began implementing a new risk- 
based grant oversight process. FAA anticipates this process will take at least 3 years to 
complete. 

• In 2011, during our audit of FAA's American Recovery and Reinvestment Act (ARRA) 
grants, FAA agreed to recover $2.1 million from the San Francisco International Airport 
for construction that was not authorized in the grant agreement. 

Improvements to DOT's payment recapture program 38 would help it detect and recover 
improper payments. In particular, DOT needs to increase its coverage of payments included 
in this program and implement follow-up actions. To illustrate, in 2011, DOT tested only 
$26 billion of its reported net costs of $78 billion. Although the recapture program 
identified improper payments totaling $266,000 that year, no changes were made to 
correct their causes. DOT plans to implement additional procedures to improve its next 
payment recapture audit. 

Making Better Use of Single Audit Findings To Improve Grantees' Financial 
Management Practices DOT faces challenges in making better use of single audit 
findings to improve its grantees' financial management practices. One reason is the 
increased volume of single audit findings associated with the infusion of ARRA funds into 
the grant management pool. To illustrate, in fiscal year 2010, we issued 89 action 
memoranda conveying deficiencies in grantees' procedures or operations to oversee grant 
funds. In fiscal years 2011 and 2012, this number grew to more than 125 action 
memoranda. 39 Single audit findings identified in these action memoranda included 
deficiencies such as improper reporting of ARRA funds spent and inadequate monitoring of 
subrecipients. In addition to procedure and oversight deficiencies, action memoranda also 
contained over $27.7 million in questioned costs during fiscal year 2012 alone. 

Another impediment to DOT's use of single audit findings is ineffective tracking systems 
intended to identify grantees with unresolved findings and problematic single audit 
histories. We found this to be the case at FHWA, FAA, and the National Highway Traffic 
Safety Administration; the Federal Railroad Administration did not have a tracking system. 
In addition, DOT policy did not establish criteria for tracking such grantees or prescribing 
actions when appropriate. As a result, it was difficult for DOT to take suitable actions (e.g., 
withholding payments) against these grantees, which are necessary to help keep grant 
funds out of the wrong hands. 



A payment recapture program consists of the review of financial records to identify overpayments that can be 
recovered. 

39 For fiscal year 2012, 122 action memoranda have been issued as of July 31, 2012. The National Single Audit Program 
Office projects at least seven more before fiscal year-end. 
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Related Products The following related documents can be found on the OIG Web site at 
http://www.oig.dot.gov . 

• DOT's Improper Payment Reporting Generally Complies with IPERA, March 15, 2012 

• DOT Needs To Improve Its Tracking and Monitoring of All Single Audit Findings in Order 
To Effectively Manage Grants, December 28, 2011 

• Improper Payments Identified in FAA's Airport Improvement Program, 
December 1, 2010 



For more information on the issues identified in this chapter, please contact 
Louis C. King, Assistant Inspector General for Financial and Information 
Technology Audits, at (202) 366-1407. 
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Ensuring Effective Management of DOT'S 
Acquisitions To Maximize Value and 
Program Performance 




Source: Department of Transportation 



In fiscal year 2011, DOT obligated approximately $68 billion on contracts and grants. 
Minimizing waste and abuse through acquisition management is an ongoing challenge for 
DOT and particularly critical given current budget limitations and recent Office of 
Management and Budget (OMB) and congressional initiatives emphasizing more 
accountability in Federal contracting. Our audits have found weaknesses in DOT's 
acquisition planning and oversight, resulting in missed opportunities to improve program 
performance and save taxpayer dollars. 

Key Challenges 

• Increasing Departmentwide management attention on the importance of acquisitions 
and governance 

• Strengthening DOT's acquisition planning, oversight, and workforce 

• Improving management oversight of recipients' contract practices to ensure program 
integrity and the efficient use of limited funds 



40 

DOT's fiscal year 2012 data were not available at the time of this report. 
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Increasing Departmentwide Management Attention on the Importance of 
Acquisitions and Governance To effectively safeguard taxpayer dollars and meet 
OMB requirements, DOT must strengthen its processes for approving and overseeing major 
acquisitions, such as its $2.2 billion information technology (IT) investment portfolio. While 
DOT has developed a proposal for an IT acquisition and investment governance structure, it 
still lacks a Departmentwide implementation plan. Institutionalizing IT procurement reform 
across DOT will remain a significant challenge given the longstanding oversight, statutory, 
and organizational barriers our work has identified. For example, even though the Federal 
Aviation Administration's (FAA) IT investments account for 94 percent ($2.07 billion) of 
DOT's investment portfolio, DOT provides limited acquisition oversight, with reviews of only 
two FAA IT programs over the last 2 years. While FAA's Joint Resources Council (JRC) is 
charged with ensuring the Agency's investments and acquisitions fulfill program priorities 
and maximize resources, FAA does not always follow its approval and oversight processes. 
For example, the JRC has not consistently held program offices accountable for submitting 
critical investment information prior to JRC decisions, which jeopardizes the success of 
billion-dollar investments. 

Another ongoing challenge is that DOT's acquisition leaders and contracting officers lack 
sufficient input and authority into program planning and decision making to help ensure the 
billions of dollars DOT spends on contracting annually are cost effective and support 
program results. In 2011 we reported that DOT's Office of the Senior Procurement 
Executive (OSPE) was not included in top-level management decisions and that the 
procurement structure did not play a strategic role in supporting DOT's missions. However, 
OSPE recently updated its strategic plan covering fiscal years 2013 through 2016 and 
reports that it now provides policy and operational support to parts of DOT responsible for 
carrying out the Department's mission. OSPE will need to work diligently to implement its 
strategic goals and recent revisions to its strategic plan to ensure that acquisition 
management is fully integrated into its decision making. Organizational weaknesses within 
various Operating Administrations' acquisition functions similarly limit their strategic roles 
in achieving program results. For example, in 2010 we reported that the Federal Motor 
Carrier Safety Administration relegated its acquisition function to an administrative support 
role rather than a partner for implementing the Agency's mission. As a result, the Agency 
did not maximize competition when awarding contracts and had inadequate contract 
oversight. FMCSA has begun to focus attention on its acquisition function in response to our 
recommendations, but sustained efforts will be needed to fully address them. 

Strengthening DOT's Acquisition Planning, Contract Oversight, and Workforce 

Ineffective acquisition planning and oversight make DOT's contract spending less cost 
effective and undermine the success of DOT's acquisitions. Our work has continually 
identified such weaknesses within some of DOT's most critical— and costly— acquisitions. 
For example: 

• Systems Engineering 2020 (SE-2020): FAA's SE-2020 contracts, with a cumulative 
maximum value of $7.3 billion, are the largest awards in FAA's history and are intended 
to help it develop the Next Generation Air Transportation System (NextGen). However, 
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FAA lacked clear requirements for ensuring fair and reasonable labor rates. FAA 
awarded the contracts using the contractors' proposed labor rates, which were 
29 percent lower than FAA's estimated rates, without submitting a required explanation 
for these significant differences. FAA also included 18 million more labor hours than 
needed in the contracts' ceilings. As a result, the contract values are overstated by as 
much as $2 billion. FAA is taking action to address our recommendations to strengthen 
its SE-2020 program and contract management. While FAA is in the early stages of using 
its SE-2020 contracts, it must continually focus on improving its contracting to manage 
and monitor future SE-2020 performance— especially given the billions of dollars the 
Agency may yet award. 

• En Route Automation Modernization (ERAM): FAA will be challenged to resolve 
shortcomings in the ERAM contract structure and execution to effectively manage costs 
and achieve desired program outcomes. The ERAM contract follows a traditional, large- 
scale approach with contract tasks that span several years instead of a modular 
approach, which would divide the contract into manageable segments for better 
control. As a result, it is difficult for FAA to track individual factors driving cost overruns. 
In addition, FAA did not effectively use two cost management tools. First, FAA's use of 
contract incentives did not motivate the contractor to manage costs because, when 
requirements grew, FAA simply increased the targeted ceiling for the contractor. At the 
time of our review, FAA had paid the contractor over $150 million of the total available 
cost incentives even though ERAM was as much as $500 million over budget. Second, 
FAA did not correctly implement earned value management (EVM) 41 to forecast 
performance trends and identify problems early on. As a result, the EVM system did not 
detect significant schedule and cost variances, which started when ERAM experienced 
software problems at the initial test site. 

FAA is beginning to address our recommendations on revising the contract structure for 
ERAM. It will now separately track costs for new software releases to better control 
spending. It will also establish five separate performance targets for each release, each with 
mandatory award criteria to encourage improved performance. FAA also recently agreed to 
restructure its EVM system to better align with program milestones and account and report 
on some authorized work. 

A key component of addressing challenges with DOT's acquisition processes will be 
strengthening the workforce DOT relies on to negotiate and administer its contracts. FAA's 
acquisition workforce is of particular concern as its billion-dollar NextGen program 
significantly increased the Agency's acquisition workload and will require more resources 
and new skills to ensure sound acquisition management. For example, in reviewing SE-2020 
contracts, we found that FAA did not require its oversight staff to receive training in 
contractor surveillance methods or use oversight plans, resulting in oversight plans that did 
not detail how to assess the contractor's work. 



Earned Value Management is a project management planning, monitoring, and control technique that integrates scope, 
schedule, and resources in such a way as to provide for the objective measurement of project performance and 
progress. 
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Improving Management Oversight of Recipients' Contract Practices To Ensure 
Program Integrity and the Efficient Use of Limited Funds Our work continues to 
identify the need for more vigilant DOT oversight of taxpayer dollars distributed through the 
Department's grant programs, including over $48 billion in American Recovery and 
Reinvestment Act (ARRA) funds. Within DOT, the Federal Highway Administration (FHWA) is 
responsible for the largest share of grants, including $27 billion in ARRA funds for highway 
projects. In 2012, we reported that FHWA's oversight does not ensure that State 
Departments of Transportation (State DOT) effectively obtain competition prior to awarding 
contracts. FHWA's guidance to State DOTs promoting competition is optional and therefore 
unenforceable. FHWA also lacks sound performance measures and monitoring tools to 
evaluate State DOT contract competition and award activity. Our review found that even 
minimal increases in the number of bids could significantly impact contract prices. 
Specifically, 19 percent of the 8,365 ARRA contracts that State DOTs awarded through 
March 31, 2010, received only 1 or 2 bids— and their prices were on average 11 percent 
higher than those with 3 bids. 42 When projected over all FHWA ARRA funds, the average 
price difference between contracts with 1 or 2 bids and those with 3 bids was at least 
$179 million. 43 Although FHWA's ARRA funds have already been awarded, the Agency needs 
to leverage the lessons learned from its oversight of ARRA contracts to foster better 
competition and maximize States' use of Federal-aid funds for future contracts. 

DOT also faces challenges in administering its Disadvantaged Business Enterprises (DBE) 
program. The DBE program is intended to help socially and economically disadvantaged 
individuals who own or control small businesses to participate in contracting opportunities 
under DOT financial assistance programs. DOT, through its recipients, distributed 
$4.4 billion to DBEs in fiscal year 2011. Our investigations have seen an increase in DBE 
fraud and abuse cases, which now represent 29 percent of our active procurement and 
grant fraud investigations. For example, in April 2012, the president of a Pennsylvania-based 
bridge beam manufacturer was convicted of fraud and money laundering in conjunction 
with a $136 million DBE fraud scheme, the largest reported DBE fraud scheme in the 
Nation's history. Our audit work shows that the Department needs to improve its 
management, recipient communication, and training for the DBE program. DOT has not 
issued standardized guidance or provided sufficient training to States responsible for 
implementing the DBE program. It also has a fragmented management approach; no single 
DOT entity is accountable for overall program management. Instead, limited aspects of 
program management are assigned to three separate DOT offices. As a result, Operating 
Administrations' oversight of recipients' DBE programs is neither consistent nor 
comprehensive, leaving weaknesses in DBE practices unaddressed. For example, during our 
review, 14 of 15 randomly selected States reported the Department had not provided them 
with comprehensive, standardized guidance on DBE regulations. Areas of concern included 
how to verify a DBE owner's personal net worth, which could allow unqualified DBEs to be 
certified. We found that two firms certified in a State failed to meet DBE eligibility 



Based on responses to our survey of 52 FHWA Division Offices for States that received ARRA funds. 
This difference should not be construed as potential savings. Rather, it highlights the importance of increasing 
competition because our results show that even minimal increases in the number of bids could have a significant 
impact on contract prices. Our projection has a 90-percent confidence level. 
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requirements in fiscal year 2009, but they collectively received over $5.4 million in DBE 
awards and payments that year. 

DOT's responsibility for billions of dollars in contract awards and ARRA funds heightens the 
importance of protecting those funds from individuals with a record of wrongdoing and 
abuse. In 2010 we reported and testified to Congress that DOT could not effectively prevent 
contract and grant awards to improper parties due to delays in its suspension and 
debarment (S&D) decisions and reporting. DOT and FAA are revising their policies to require 
timely action on S&D decisions. However, DOT can do more to leverage the protections of 
its S&D program. For example, our 2012 audit of FHWA's oversight of State contracting 
practices for ARRA-funded projects found that FHWA Division Offices needed better 
controls to prevent States' awards to improper parties. These include written confirmation 
from State DOTs that they checked the suspension and debarment database before 
granting an award. 

Finally, our investigations continue to identify the need for more vigilant oversight to detect 
and prevent procurement and grant fraud, waste, and abuse within DOT and among its fund 
recipients. Grant and procurement fraud cases currently comprise about 50 percent of our 
active investigations. Between October 2011 and August 2012, procurement and grant 
fraud investigations resulted in 49 indictments, 19 convictions, and $24 million in fines and 
other recoveries. Our investigations also pointed to DOT's challenges in ensuring that its 
grantees' contractors' expenses are proper. For example, in November 2011, the former 
chief executive officer of EV Worldwide LLC was ordered to pay $4.25 million to the Federal 
Transit Administration as a result of his participation in a scheme to submit fraudulent 
invoices for ineligible and questionable expenses on a transit authority project. 
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Related Products The following related documents can be found on the OIG Web site at 
http://www.oig.dot.gov . 

• Weaknesses in Program and Contract Management Contribute To ERAM Delays and Put 
Other NextGen Initiatives at Risk, September 13, 2012 

• Lessons Learned From ARRA: Improved FHWA Oversight Can Enhance States' Use of 
Federal-Aid Funds, April 5, 2012 

• FAA's Contracting Practices Are Insufficient To Effectively Manage Its Systems 
Engineering 2020 Contracts, March 28, 2012 

• FAA Policies and Plans Are Insufficient To Ensure an Adequate and Effective Acquisition 
Workforce, August 3, 2011 

• Weaknesses in the Office of the Secretary's Acquisition Function Limit Its Capacity To 
Support DOT'S Mission, May 25, 2011 

• Federal Motor Carrier Safety Administration Lacks Core Elements for a Successful 
Acquisition Function, August 24, 2010 

• Weaknesses in DOT's Suspension and Debarment Program Limit Its Protection of 
Government Funds, March 18, 2010 

• DOT's Suspension and Debarment Program Does Not Safeguard Against Awards to 
Improper Parties, January 7, 2010 



For more information on the issues identified in this chapter, please contact 
Mary Kay Langan-Feirson, Assistant Inspector General for Acquisition and 
Procurement Audits, at (202) 366-5225 or Timothy Barry, Principal Assistant 
Inspector General for Investigations, at (202) 366-1967. 
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Managing and Securing Information 
Systems To Efficiently Modernize 
Technology Infrastructure and Protect 
Sensitive Data From Compromise 




Source: Used with permission from Microsoft 



DOT faces the ongoing challenge of modernizing its systems to keep pace with new 
technologies that change how DOT entities conduct business and create complex 
information security issues. Departmental operations rely on more than 400 information 
systems— nearly two-thirds of which belong to the Federal Aviation Administration (FAA). 
However, DOT currently lacks a blueprint, known as an enterprise architecture (EA), to 
effectively guide changes to its infrastructure. Security is a top priority since breaches by 
computer hackers have placed a number of major entities at risk and have exposed 
individuals' personal information to unauthorized access. In 2010 and 2011, the 
Department declared the deficiencies in its information security program to be a material 
weakness. 

Key Challenges 

• Creating an effective Departmentwide EA program 

• Establishing a robust information security program 

• Protecting sensitive information 
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Creating an Effective Departmentwide EA Program Creating a functional ea 
will remain a major challenge for the Department in the years to come. An agency's EA 
program is necessary to help management understand its current technology infrastructure, 
define how future infrastructure should accomplish its mission, and develop a transition 
plan. Despite its $48 million investment and years of effort towards creating an EA, DOT still 
lacks adequate EA policy and procedures, direction in the selection of EA development 
tools, performance measures, and an approved plan to build a Departmentwide EA. Absent 
this blueprint, the Department faces significant challenges in maximizing its returns on IT 
investments through cost savings, reduced duplicative systems, aligned information 
technology and mission, and effective information security spending— all critical elements 
in an environment of dwindling resources. 

Establishing a Robust Information Security Program Last year, we reported 
that the Department's information security program did not meet key Office of 
Management and Budget (OMB) and Federal Information Security Management Act 
(FISMA) requirements to protect agency information and systems. As a result, in 2011, DOT 
again declared its information security deficiencies a material weakness in its annual 
assurance statement, as required by the Federal Managers' Financial Integrity Act. 44 DOT 
has made limited progress in fiscal year 2012 toward correcting weaknesses in key control 
areas. 

The Department's Office of the Chief Information Officer (OCIO), the modal Administrators, 
and their ClOs are collectively responsible for implementing and maintaining a robust 
computer security program. Our work has found that OCIO could do more to guide and 
oversee Operating Administrations in building and sustaining strong information security 
practices. For example, OCIO has yet to issue Departmentwide procedural guidance or 
improve quality assurance reviews of modal cyber security efforts. The Department recently 
deployed an automated software tool that, when fully implemented, will monitor the cyber 
security status of a limited number of information technology devices (e.g., desktop 
computers). However, DOT has not provided a plan to address the remaining devices. In 
addition, our work continues to identify mode-specific security deficiencies. For example, 
our ongoing work on air traffic control systems has identified weaknesses in access controls 
and incident reporting that FAA needs to remediate. To build a strong information security 
program, the Department and the Operating Administrations must work together to 
continue addressing these deficiencies in a sustainable and flexible manner so that DOT can 
quickly adapt to and avert new cyber threats. 

Protecting Sensitive Information To safeguard against the breach of personally 
identifiable information (Pll), OMB requires agencies to reduce the volume of information 
collected and maintained, restrict access, and implement other security controls (e.g., 
encryption) to prevent unauthorized access. The main goal of information security 
management is to protect the confidentiality, availability, and integrity of information, of 
which Pll is a critical piece. As such, almost any weakness in security controls on systems 



Federal Managers' Financial Integrity Act, Pub. L. No. 97-255 (1982). 
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containing Pll increases the risk that sensitive data could be exposed, which would be 
detrimental to the Department's mission and credibility. 

In fiscal year 2011, the Department provided plans for reducing Pll and the use of Social 
Security numbers and for establishing the required privacy protections. Although the 
Department is committed to providing privacy protections by securing Pll, the associated 
reductions in the volume of Pll will not be complete until 2013. Vigilant follow through is 
critical, given some of the weaknesses our work has identified. For example, our ongoing 
review of the Civil Aviation Registry, which contains Pll of airmen and aircraft owners, found 
that Pll data were not adequately protected from compromise. We identified numerous 
deficiencies in the configuration of the Registry system's software that render it vulnerable 
to attacks that can lead to unauthorized access. According to FAA, the upgrades to correct 
these vulnerabilities are slated for implementation during fiscal year 2013. 

Related Products The following related documents can be found on the OIG Web site at 
http://www.oig.dot.gov . 

• The U.S. Merchant Marine Academy's Security Controls Were Not Sufficient To Protect 
Sensitive Data from Unauthorized Access, May 30, 2012 

• DOT Does Not Have an Effective Enterprise Architecture Program for Management of 
Information Technology Changes, April 17, 2012 

• FISMA 2011: Persistent Weaknesses in DOT's Controls Challenge the Protection and 
Security of Its Information Systems, November 14, 2011 



For more information on the issues identified in this chapter, please contact 
Louis C. King, Assistant Inspector General for Financial and Information 
Technology Audits, at (202) 366-1407. 
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Comparison of Fiscal Years 2013 and 2012 
Top Management Challenges 



Fiscal Year 2013 Challenges Fiscal Year 2012 Challenges 



• 


Ensuring the Next Generation Air 
Transportation System Advances Safety 
and Air Travel 


• Managing the Next Generation Air 
Transportation System Advancement While 
Controlling Costs 


• 


Enhancing FAA's Oversight and Use of 
Data To Identify and Mitigate Safety Risks 


• Ensuring Effective Oversight on Key Initiatives 
That Can Improve Aviation Safety 


• 


Overseeing Administration of Key 
Transportation Assets To Ensure Their 
Success and Sustainability 




• 


Strengthening Existing Surface Safety 

riUgidiiio diiu ciicLLivciy 1 1 1 ipici i ici I ui 

New Safety Requirements 


• Enhancing DOT's Oversight of Highway, Bridge 

a 1 1 U llallolLOalcly 

• Ensuring Effective Oversight of Hazardous 
Liquid and Natural Gas Pipeline Safety 


• 


Maximizing Surface Infrastructure 
Investments With Effective Program 
Oversight and Execution of New 
Legislative Requirements 


• Ensuring Effective Oversight of ARRA Projects 
and Applying Related Lessons Learned To 
Improve DOT's Infrastructure Programs 


• 


Adequately Overseeing Administration of 
High Speed Intercity Passenger Rail Grant 
Funds 


• Defining Clear Goals To Guide the Federal 
Railroad Administration in Its Transformation 


• 


Strengthening Financial Management 
Over Grants To Better Use Funds, Create 
Jobs, and Improve Infrastructure 




• 


Ensuring Effective Management of DOT's 
Acquisitions To Maximize Value and 
Program Performance 


• Managing DOT Acquisitions in a Smarter and 
More Strategic Manner To Maximize Limited 
Resources and Achieve Better Mission Results 


• 


Managing and Securing Information 
Systems To Efficiently Modernize 
Technology Infrastructure and Protect 
Sensitive Data From Compromise 


• Improving the Department's Cyber Security 


• Utilizing Department Credit Programs To 
Leverage Limited Federal Transportation 
Infrastructure Resources 



2013 Top Management Challenges, Department of Transportation 



39 



APPENDIX. DEPARTMENT RESPONSE 




Memorandum 



U.S. Department of 

Transportation 

Office of the Secretary 
of Transportation 



Subject: ACTION: Management Comments on OIG Draft 
Report on Top Management Challenges 



Date: 



November 9, 2012 



Christopher P. Bertram 




Assistant Secretary for Budget and Programs, 
and Chief Financial Officer 

To: Calvin L. Scovel, III 
Inspector General 

The Department is fully engaged in each of the issues enumerated in the OIG report and has 
actions underway throughout the organization to effectively address these and the myriad other 
policy and programmatic responsibilities of the Department. Notably, the Department is 
aggressively addressing the challenges of implementing the recently enacted P.L. 112-141, the 
Moving Ahead for Progress in the 21st Century Act (MAP-21). MAP-21 introduces substantial 
new programs and responsibilities for the Department of Transportation. For example, it enables 
the Federal Transit Administration to, for the first time, create a nationwide framework for 
enhanced rail transit safety. MAP-21 also creates a streamlined, performance-based, and 
multimodal approach for investing in surface transportation infrastructure. Enhanced 
performance management requirements will transform Federal highway programs and enable 
more efficient Federal investment in transportation by focusing on national transportation goals, 
increase accountability and transparency for Federal highway programs, and improve 
transportation investment decision making. In addition, the new law vastly expands the use of 
innovative financing through the TIFIA program which leverages Federal investment in 
transportation, by attracting private and other non-Federal co-investment in critical 
improvements to the Nation's surface transportation system. 

Most of the remaining challenges enumerated in the OIG report are familiar recurring issues. 
For example, Air Traffic Modernization is a continuous effort to maintain and improve the 
Nation's exceptionally strong aviation safety record through the judicious application of state-of-the- 
art technology. As technology continues to change and enable improved capabilities, the 
Department has harnessed these capabilities to enhance safety with considerable success over the 
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last few decades. The Department has carefully structured new programs to serve continued 
growth in the Nation's economy and provide additional good paying jobs. For example, our 
efforts in high speed intercity passenger rail are already making a difference throughout the 
nation and will continue to do so for years to come thanks to careful planning, a performance- 
oriented, data-driven selection process, and carefully structured oversight. 

Beyond the familiar recurring issues in the management challenges report we note the section on 
key transportation assets. There are several points in this regard that merit particular attention, 
notably: our efforts to ensure the Metropolitan Washington Airport Authority (MWAA) is run in 
a manner commensurate with the public trust; efforts to ensure that Union Station is run in a 
manner consistent with its role as a vital transportation hub and landmark within the City of the 
District of Columbia; and our work to ensure that investment in the Nation's Merchant Marine 
Academy is well planned, prioritized, and executed to serve the needs of its students, and the 
nation. 

The Department took swift action to the full extent of its statutory authority, to address the 
deeply troubling issues that have come to light with regard to the personnel, contracting, and 
business practices at MWAA. DOT has been working with MWAA to ensure it acts quickly to 
adopt policies and procedures that establish a strong and appropriate framework guiding the 
actions of its officers and staff. The Department has taken the extraordinary measure of 
appointing a Federal Accountability Officer to provide guidance to MWAA as it revises its 
policies and procedures, bringing them in line with Federal agency best practices. As this work 
continues, it is vitally important that strong oversight and internal controls are established to 
ensure MWAA adheres to its new policies. As established by statute, MWAA is a public entity 
with considerable autonomy. While the Department will continue to hold MWAA accountable 
in its management and operation of vitally important Federal assets, it is primarily incumbent on 
MWAA to institute the reforms needed to regain the public's trust. 

At Union Station, the Department is exercising its authority on the Board of Directors of the 
Union Station Redevelopment Corporation (USRC) to provide strong and effective leadership 
and to take the actions necessary to protect this iconic structure, while carefully planning its role 
as an intermodal transportation hub. The Department is fully engaged in activities to ensure that 
the Board is led by highly qualified individuals with the vision and authority necessary to 
provide effective management of this important transportation asset. We are also working to 
ensure that appropriate policies and procedures are in place to ensure the organization functions 
effectively. Detailed analysis is ongoing with regard to cost centers to ensure that every dollar is 
well and constructively spent. The Department is working with the Board of Directors and 
actively monitoring progress as the newly appointed President of the USRC continues to sort 
through issues, obtain stakeholder input and identify priorities. 

The Department has implemented comprehensive and detailed processes to help ensure the 
United States Merchant Marine Academy can continue training a dependable cadre of highly 
capable merchant mariners to serve the country in times of war and helping to maintain a viable 
U.S. maritime industry in times of peace. Specifically, the Department has put in place a capital 
investment process that provides a data driven approach to identifying and prioritizing 
investments in the Academy. This process is led by an executive committee, with 
representatives from the Office of the Secretary, the Maritime Administration, and the Academy. 
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Finally, the Department continues to ensure that it provides strong and effective financial 
management. In particular, the Department made progress this year in addressing a new 
challenge identified by the OIG to strengthen financial management over grants in order to better 
use funds. Late in FY 2012, Operating Administrations (OAs) undertook a major effort to 
review, verify, and correct as necessary outstanding grant obligations for significant projects. 
These balances are categorized as "Undelivered Orders" (UDOs) for these programs in our 
annual Statement of Budgetary Resources. Further, we have completed intensive day-long 
training sessions for key OA grants and acquisitions staff in proper grant close-out procedures, 
which will greatly improve the financial management of these critical programs. Also, we have 
developed a new Departmental Order that will be issued shortly governing the quarterly review 
of all UDO balances, with a primary emphasis on outstanding grant obligations. This too will 
strengthen our financial management of grants throughout the Department. 

With prospects for continued operation in an increasingly resource constrained environment, the 
Department is looking for new approaches to facilitate effective programmatic performance. 
This will require new perspectives beyond the traditional approaches that call for adding new 
oversight, additional programs, or increased spending to address problems. The Department 
intends to explore new approaches that make better use of technology and use more efficient 
processes to function effectively in an era of diminishing resource availability. We look to the 
Office of Inspector General as a partner in this endeavor, by keeping this imperative in mind in 
addressing issues, making recommendations for management action, and conducting its 
interactions with us in an effective and efficient manner. 
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